2020-07-26 05:23:57

by Gaurav Singh

Subject: [PATCH] [video/fbdev] mbxfb_remove: fix null pointer dereference

Function mbxfb_debugfs_remove() accesses fbi->par without NULL check,
hence do the NULL check in the caller mbxfb_remove().

Signed-off-by: Gaurav Singh <[email protected]>
---
drivers/video/fbdev/mbx/mbxfb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/mbx/mbxfb.c b/drivers/video/fbdev/mbx/mbxfb.c
index 6dc287c819cb..515c0cda1994 100644
--- a/drivers/video/fbdev/mbx/mbxfb.c
+++ b/drivers/video/fbdev/mbx/mbxfb.c
@@ -1012,11 +1012,10 @@ static int mbxfb_remove(struct platform_device *dev)

write_reg_dly(SYSRST_RST, SYSRST);

- mbxfb_debugfs_remove(fbi);
-
if (fbi) {
struct mbxfb_info *mfbi = fbi->par;

+ mbxfb_debugfs_remove(fbi);
unregister_framebuffer(fbi);
if (mfbi) {
if (mfbi->platform_remove)
--
2.17.1

2020-07-26 08:59:03

by Andy Shevchenko

Subject: Re: [PATCH] [video/fbdev] mbxfb_remove: fix null pointer dereference

On Sun, Jul 26, 2020 at 8:26 AM Gaurav Singh <[email protected]> wrote:
>
> Function mbxfb_debugfs_remove() accesses fbi->par without NULL check,
> hence do the NULL check in the caller mbxfb_remove().

...

> @@ -1012,11 +1012,10 @@ static int mbxfb_remove(struct platform_device *dev)
>
> write_reg_dly(SYSRST_RST, SYSRST);
>
> - mbxfb_debugfs_remove(fbi);
> -

> if (fbi) {

Can you explain how this is NULL on ->remove()?

I bet this check is simply redundant. But you have to check and update
commit message accordingly.

> struct mbxfb_info *mfbi = fbi->par;
>
> + mbxfb_debugfs_remove(fbi);
> unregister_framebuffer(fbi);
> if (mfbi) {
> if (mfbi->platform_remove)


--
With Best Regards,
Andy Shevchenko